Shan's "Fix IT in 1 Minute!" UNIX Admin Blog: TCP/IP Protocols and Security

Showing posts with label TCP/IP Protocols and Security. Show all posts

TCP connection states vs netstat output

TCP/IP 3-way handshake.

TCP Connection States

Following is a brief explanation of this handshake. In this context the "client" is the peer requesting a connection and the "server" is the peer accepting a connection. Note that this notation does not reflect Client/Server relationships as an architectural principal.

Connection Establishment
- The client sends a SYN message which contains the server's port and the client's Initial Sequence Number (ISN) to the server (active open).
- The server sends back its own SYN and ACK (which consists of the client's ISN + 1).
- The Client sends an ACK (which consists of the server's ISN + 1).
Connection Tear-down (modified three way handshake).
- The client sends a FIN (active close). This is a now a half-closed connection. The client no longer sends data, but is still able to receive data from the server. Upon receiving this FIN, the server enters a passive close state.
- The server sends an ACK (which is the clients FIN sequence + 1)
- The server sends its own FIN.
- The client sends an ACK (which is server's FIN sequence + 1). Upon receiving this ACK, the server closes the connection.

A half-closed connection can be used to terminate sending data while sill receiving data. Socket applications can call shutdown with the second argument set to 1 to enter this state.

Netstat Output

The above TCP connection states can be monitored in a network trace under the TCP flags. It is also possible to determine the status of the connection by running the Netstat utility and looking at the State column.

State explanations as shown in Netstat:

State Explanation
------------ --------------------------------------------------------

SYN_SEND Indicates active open.

SYN_RECEIVED Server just received SYN from the client.

ESTABLISHED Client received server's SYN and session is established.

LISTEN Server is ready to accept connection.

NOTE: See documentation for listen() socket call. TCP sockets in listening state are not shown - this is a limitation of NETSTAT. For additional information, please see the following article in the Microsoft Knowledge Base:

134404 (http://support.microsoft.com/kb/134404/EN-US/ ) NETSTAT Does Not Show TCP Listen Sockets

FIN_WAIT_1 Indicates active close.

TIME_WAIT Client enters this state after active close.

CLOSE_WAIT Indicates passive close. Server just received first FIN from a client.

FIN_WAIT_2 Client just received acknowledgment of its first FIN from the server.

LAST_ACK Server is in this state when it sends its own FIN.

CLOSED Server received ACK from client and connection is closed.

As an example, consider the following scenario:

A socket application has been terminated, but Netstat reports the socket in a CLOSE_WAIT state. This could indicate that the client properly closed the connection (FIN has been sent), but the server still has its socket open. This could be the result of one instance (among all threads or processes) of the socket not being closed.

NOTE: It is normal to have a socket in the TIME_WAIT state for a long period of time. The time is specified in RFC793 as twice the Maximum Segment Lifetime (MSL). MSL is specified to be 2 minutes. So, a socket could be in a TIME_WAIT state for as long as 4 minutes. Some systems implement different values (less than 2 minutes) for the MSL. See below for details:

Code:

   Client                                                   Server
   ======                                                   ======
   ESTABLISHED                                              ESTABLISHED
   (client closes)
   ESTABLISHED                                              ESTABLISHED
                 ------->>
   FIN_WAIT_1
                <<-------- 
   FIN_WAIT_2                                               CLOSE_WAIT
                <<--------   (server closes)
                                                            LAST_ACK
                , ------->>
   TIME_WAIT                                                CLOSED
   (2*msl elapses...)
   CLOSED

Note: the +1 on the sequence numbers is because the FIN counts as one byte of data. (The above diagram is equivalent to fig. 13 from RFC 793).

Additional references:

"Internetworking with TCP/IP, Volume 1" by Douglas Comer
"TCP/IP Illustrated, Volume 1" by Richard Stevens.
"Computer Networks" by Andrew Tanenbaum

Below is a tcpdump (Solaris' snoop) verbose output of an rpcinfo -p query made by a linux host to Sun Solaris server. It shows details of TCP/IP 3-way handshake SYN -> SYN/ACK -> ACK between a Linux host (ipc4) and a Solaris server (sun1).

To understand rpc, please see my blog article Understand Remote Procedure Call in 1 Minute

Summary:

1 0.00000 ipc4.shanjing.com -> sun1.shanjing.com TCP D=111 S=750 Syn Seq=3368322776 Len=0 Win=5840 Options=
2 0.00031 sun1.shanjing.com -> ipc4.shanjing.com TCP D=750 S=111 Syn Ack=3368322777 Seq=1322806787 Len=0 Win=49232 Options=
3 0.00004 ipc4.shanjing.com -> sun1.shanjing.com TCP D=111 S=750 Ack=1322806788 Seq=3368322777 Len=0 Win=1460 Options=
4 0.00013 ipc4.shanjing.com -> sun1.shanjing.com PORTMAP C DUMP
5 0.00022 sun1.shanjing.com -> ipc4.shanjing.com TCP D=750 S=111 Ack=3368322821 Seq=1322806788 Len=0 Win=49188 Options=
6 0.00093 ipc4.shanjing.com -> sun1.shanjing.com TCP D=111 S=750 Ack=1322807580 Seq=3368322821 Len=0 Win=1856 Options=
7 0.00001 sun1.shanjing.com -> ipc4.shanjing.com PORTMAP R DUMP 38 map(s) found
8 0.01263 ipc4.shanjing.com -> sun1.shanjing.com TCP D=111 S=750 Fin Ack=1322807580 Seq=3368322821 Len=0 Win=1856 Options=
9 0.00013 sun1.shanjing.com -> ipc4.shanjing.com TCP D=750 S=111 Ack=3368322822 Seq=1322807580 Len=0 Win=49232 Options=
10 0.00032 sun1.shanjing.com -> ipc4.shanjing.com TCP D=750 S=111 Fin Ack=3368322822 Seq=1322807580 Len=0 Win=49232 Options=
11 0.00013 ipc4.shanjing.com -> sun1.shanjing.com TCP D=111 S=750 Ack=1322807581 Seq=3368322822 Len=0 Win=1856 Options=

Details:
ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 1 arrived at 22:24:53.67045
ETHER: Packet size = 74 bytes
ETHER: Destination = 0:c:29:2e:ed:c1,
ETHER: Source = 0:c:29:e5:d:fb,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 60 bytes
IP: Identification = 5703
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = a058
IP: Source address = 192.168.1.104, ipc4.shanjing.com
IP: Destination address = 192.168.1.100, sun1.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 750
TCP: Destination port = 111
TCP: Sequence number = 3368322776
TCP: Acknowledgement number = 0
TCP: Data offset = 40 bytes
TCP: Flags = 0x02
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...0 .... = No acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..1. = Syn
TCP: .... ...0 = No Fin
TCP: Window = 5840
TCP: Checksum = 0xc95d
TCP: Urgent pointer = 0
TCP: Options: (20 bytes)
TCP: - Maximum segment size = 1460 bytes
TCP: - SACK permitted option
TCP: - TS Val = 2134176, TS Echo = 0
TCP: - No operation
TCP: - Window scale = 2
TCP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 2 arrived at 22:24:53.67077
ETHER: Packet size = 78 bytes
ETHER: Destination = 0:c:29:e5:d:fb,
ETHER: Source = 0:c:29:2e:ed:c1,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 64 bytes
IP: Identification = 27277
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = 4c0e
IP: Source address = 192.168.1.100, sun1.shanjing.com
IP: Destination address = 192.168.1.104, ipc4.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 111
TCP: Destination port = 750
TCP: Sequence number = 1322806787
TCP: Acknowledgement number = 3368322777
TCP: Data offset = 44 bytes
TCP: Flags = 0x12
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..1. = Syn
TCP: .... ...0 = No Fin
TCP: Window = 49232
TCP: Checksum = 0xeedf
TCP: Urgent pointer = 0
TCP: Options: (24 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 1532405, TS Echo = 2134176
TCP: - Maximum segment size = 1460 bytes
TCP: - No operation
TCP: - Window scale = 0
TCP: - No operation
TCP: - No operation
TCP: - SACK permitted option
TCP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 3 arrived at 22:24:53.67082
ETHER: Packet size = 66 bytes
ETHER: Destination = 0:c:29:2e:ed:c1,
ETHER: Source = 0:c:29:e5:d:fb,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 52 bytes
IP: Identification = 5705
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = a05e
IP: Source address = 192.168.1.104, ipc4.shanjing.com
IP: Destination address = 192.168.1.100, sun1.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 750
TCP: Destination port = 111
TCP: Sequence number = 3368322777
TCP: Acknowledgement number = 1322806788
TCP: Data offset = 32 bytes
TCP: Flags = 0x10
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...0 = No Fin
TCP: Window = 1460
TCP: Checksum = 0xea46
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 2134177, TS Echo = 1532405
TCP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 4 arrived at 22:24:53.67095
ETHER: Packet size = 110 bytes
ETHER: Destination = 0:c:29:2e:ed:c1,
ETHER: Source = 0:c:29:e5:d:fb,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 96 bytes
IP: Identification = 5707
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = a030
IP: Source address = 192.168.1.104, ipc4.shanjing.com
IP: Destination address = 192.168.1.100, sun1.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 750
TCP: Destination port = 111 (Sun RPC)
TCP: Sequence number = 3368322777
TCP: Acknowledgement number = 1322806788
TCP: Data offset = 32 bytes
TCP: Flags = 0x18
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 1... = Push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...0 = No Fin
TCP: Window = 1460
TCP: Checksum = 0xe454
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 2134177, TS Echo = 1532405
TCP:
RPC: ----- SUN RPC Header -----
RPC:
RPC: Record Mark: last fragment, length = 40
RPC: Transaction id = 450618384
RPC: Type = 0 (Call)
RPC: RPC version = 2
RPC: Program = 100000 (PMAP), version = 2, procedure = 4
RPC: Credentials: Flavor = 0 (None), len = 0 bytes
RPC: Verifier : Flavor = 0 (None), len = 0 bytes
RPC:
PMAP: ----- Portmapper -----
PMAP:
PMAP: Proc = 4 (Dump the mappings)
PMAP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 5 arrived at 22:24:53.67117
ETHER: Packet size = 66 bytes
ETHER: Destination = 0:c:29:e5:d:fb,
ETHER: Source = 0:c:29:2e:ed:c1,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 52 bytes
IP: Identification = 27278
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = 4c19
IP: Source address = 192.168.1.100, sun1.shanjing.com
IP: Destination address = 192.168.1.104, ipc4.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 111
TCP: Destination port = 750
TCP: Sequence number = 1322806788
TCP: Acknowledgement number = 3368322821
TCP: Data offset = 32 bytes
TCP: Flags = 0x10
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...0 = No Fin
TCP: Window = 49188
TCP: Checksum = 0x2faa
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 1532405, TS Echo = 2134177
TCP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 6 arrived at 22:24:53.67211
ETHER: Packet size = 66 bytes
ETHER: Destination = 0:c:29:2e:ed:c1,
ETHER: Source = 0:c:29:e5:d:fb,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 52 bytes
IP: Identification = 5709
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = a05a
IP: Source address = 192.168.1.104, ipc4.shanjing.com
IP: Destination address = 192.168.1.100, sun1.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 750
TCP: Destination port = 111
TCP: Sequence number = 3368322821
TCP: Acknowledgement number = 1322807580
TCP: Data offset = 32 bytes
TCP: Flags = 0x10
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...0 = No Fin
TCP: Window = 1856
TCP: Checksum = 0xe574
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 2134179, TS Echo = 1532405
TCP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 7 arrived at 22:24:53.67212
ETHER: Packet size = 858 bytes
ETHER: Destination = 0:c:29:e5:d:fb,
ETHER: Source = 0:c:29:2e:ed:c1,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 844 bytes
IP: Identification = 27279
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = 4900
IP: Source address = 192.168.1.100, sun1.shanjing.com
IP: Destination address = 192.168.1.104, ipc4.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 111
TCP: Destination port = 750 (Sun RPC)
TCP: Sequence number = 1322806788
TCP: Acknowledgement number = 3368322821
TCP: Data offset = 32 bytes
TCP: Flags = 0x18
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 1... = Push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...0 = No Fin
TCP: Window = 49232
TCP: Checksum = 0xf9c4
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 1532405, TS Echo = 2134177
TCP:
RPC: ----- SUN RPC Header -----
RPC:
RPC: Record Mark: last fragment, length = 788
RPC: Transaction id = 450618384
RPC: Type = 1 (Reply)
RPC: This is a reply to frame 4
RPC: Status = 0 (Accepted)
RPC: Verifier : Flavor = 0 (None), len = 0 bytes
RPC: Accept status = 0 (Success)
RPC:
PMAP: ----- Portmapper -----
PMAP:
PMAP: Proc = 4 (Dump the mappings)
PMAP: Program Version Protocol Port
PMAP: 100000 4 6 111 PMAP
PMAP: 100000 3 6 111 PMAP
PMAP: 100000 2 6 111 PMAP
PMAP: 100000 4 17 111 PMAP
PMAP: 100000 3 17 111 PMAP
PMAP: 100000 2 17 111 PMAP
PMAP: 100024 1 17 32772 STATMON2
PMAP: 100024 1 6 32771 STATMON2
PMAP: 100133 1 17 32772 ?
PMAP: 100133 1 6 32771 ?
PMAP: 1073741824 1 6 32772 transient
PMAP: 100021 1 17 4045 NLM
PMAP: 100021 2 17 4045 NLM
PMAP: 100021 3 17 4045 NLM
PMAP: 100021 4 17 4045 NLM
PMAP: 100021 1 6 4045 NLM
PMAP: 100021 2 6 4045 NLM
PMAP: 100021 3 6 4045 NLM
PMAP: 100021 4 6 4045 NLM
PMAP: 100001 2 17 32773 RSTAT
PMAP: 100001 3 17 32773 RSTAT
PMAP: 100001 4 17 32773 RSTAT
PMAP: 100068 2 17 32774 CMSD
PMAP: 100068 3 17 32774 CMSD
PMAP: 100068 4 17 32774 CMSD
PMAP: 100068 5 17 32774 CMSD
PMAP: 100083 1 6 32775 ?
PMAP: 100002 2 6 32776 RUSERS
PMAP: 100002 3 6 32776 RUSERS
PMAP: 100002 2 17 32775 RUSERS
PMAP: 100002 3 17 32775 RUSERS
PMAP: 100011 1 17 32776 RQUOTA
PMAP: 300598 1 17 32779 ?
PMAP: 300598 1 6 32777 ?
PMAP: 805306368 1 17 32779 ?
PMAP: 805306368 1 6 32777 ?
PMAP: 100249 1 17 32780 ?
PMAP: 100249 1 6 32778 ?
PMAP: 38 maps
PMAP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 8 arrived at 22:24:53.68476
ETHER: Packet size = 66 bytes
ETHER: Destination = 0:c:29:2e:ed:c1,
ETHER: Source = 0:c:29:e5:d:fb,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 52 bytes
IP: Identification = 5711
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = a058
IP: Source address = 192.168.1.104, ipc4.shanjing.com
IP: Destination address = 192.168.1.100, sun1.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 750
TCP: Destination port = 111
TCP: Sequence number = 3368322821
TCP: Acknowledgement number = 1322807580
TCP: Data offset = 32 bytes
TCP: Flags = 0x11
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...1 = Fin
TCP: Window = 1856
TCP: Checksum = 0xe562
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 2134196, TS Echo = 1532405
TCP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 9 arrived at 22:24:53.68489
ETHER: Packet size = 66 bytes
ETHER: Destination = 0:c:29:e5:d:fb,
ETHER: Source = 0:c:29:2e:ed:c1,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 52 bytes
IP: Identification = 27280
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = 4c17
IP: Source address = 192.168.1.100, sun1.shanjing.com
IP: Destination address = 192.168.1.104, ipc4.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 111
TCP: Destination port = 750
TCP: Sequence number = 1322807580
TCP: Acknowledgement number = 3368322822
TCP: Data offset = 32 bytes
TCP: Flags = 0x10
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...0 = No Fin
TCP: Window = 49232
TCP: Checksum = 0x2c51
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 1532406, TS Echo = 2134196
TCP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 10 arrived at 22:24:53.68522
ETHER: Packet size = 66 bytes
ETHER: Destination = 0:c:29:e5:d:fb,
ETHER: Source = 0:c:29:2e:ed:c1,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 52 bytes
IP: Identification = 27281
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = 4c16
IP: Source address = 192.168.1.100, sun1.shanjing.com
IP: Destination address = 192.168.1.104, ipc4.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 111
TCP: Destination port = 750
TCP: Sequence number = 1322807580
TCP: Acknowledgement number = 3368322822
TCP: Data offset = 32 bytes
TCP: Flags = 0x11
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...1 = Fin
TCP: Window = 49232
TCP: Checksum = 0x2c50
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 1532406, TS Echo = 2134196
TCP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 11 arrived at 22:24:53.68535
ETHER: Packet size = 66 bytes
ETHER: Destination = 0:c:29:2e:ed:c1,
ETHER: Source = 0:c:29:e5:d:fb,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 52 bytes
IP: Identification = 2
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = b6a5
IP: Source address = 192.168.1.104, ipc4.shanjing.com
IP: Destination address = 192.168.1.100, sun1.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 750
TCP: Destination port = 111
TCP: Sequence number = 3368322822
TCP: Acknowledgement number = 1322807581
TCP: Data offset = 32 bytes
TCP: Flags = 0x10
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...0 = No Fin
TCP: Window = 1856
TCP: Checksum = 0xe55e
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 2134198, TS Echo = 1532406
TCP:

Understanding TCP Headers in 1 Minute!

TCP characteristics

The TCP protocol resides on top of the IP protocol. It is a stateful protocol and has built-in functions to see that the data was received properly by the other end host.

The main goals of the TCP protocol is to see:
1. data is reliably received and sent;
2. the data is transported between the Internet layer and Application layer correctly;
3. the packet data reaches the proper program in the application layer;
4. the data reaches the program in the right order.

All of this is possible through the TCP headers of the packet.

SYN three-way handshake (S)SYN-> (D) SYNC/ACK -> (S) ACK

The TCP protocol looks at data as an continuous data stream with a start and a stop signal. The signal that indicates that a new stream is waiting to be opened is called a SYN three-way handshake in TCP, and consists of one packet sent with the SYN bit set. The other end then either answers with SYN/ACK or SYN/RST to let the client know if the connection was accepted or denied, respectively. If the client receives an SYN/ACK packet, it once again replies, this time with an ACK packet. At this point, the whole connection is established and data can be sent.

During this initial handshake, all of the specific options that will be used throughout the rest of the TCP connection is also negotiated, such as ECN, SACK, etcetera.

An example of TCP SYN 3-way handshake: (a complete transmission is attached at the end of the blog)

1 0.00000 ipc4.shanjing.com -> sun1.shanjing.com TCP D=111 S=750 Syn Seq=3368322776 Len=0 Win=5840 Options=
2 0.00031 sun1.shanjing.com -> ipc4.shanjing.com TCP D=750 S=111 Syn Ack=3368322777 Seq=1322806787 Len=0 Win=49232 Options=
3 0.00004 ipc4.shanjing.com -> sun1.shanjing.com TCP D=111 S=750 Ack=1322806788 Seq=3368322777 Len=0 Win=1460 Options=

Once 3-way handshake is successful, data is sent. The above shows a successful SYN 3-way handshake initiated from a Linux server "ipc4" to a Solaris server "sun1" requesting rpcinfo (the Linux term is portmap).

4 0.00013 ipc4.shanjing.com -> sun1.shanjing.com PORTMAP C DUMP

The Sequence Number – The Reliability Part of TCP
While the datastream is alive, we have further mechanisms to see that the packets are actually received properly by the other end. This is the reliability part of TCP. This is done in a simple way, using a Sequence number in the packet (see above sample TCP's Seq number highlighted in black). Every time we send a packet, we give a new value to the Sequence number, and when the other end receives the packet, it sends an ACK packet back to the data sender. The ACK packet acknowledges that the packet was received properly. The sequence number also sees to it that the packet is inserted into the data stream in a good order.

Closing the connection – FIN -> FIN/ACK
Once the connection is closed, this is done by sending a FIN packet from either end-point. The other end then responds by sending a FIN/ACK packet. The FIN sending end can then no longer send any data, but the other end-point can still finish sending data. Once the second end-point wishes to close the connection totally, it sends a FIN packet back to the originally closing end-point, and the other end-point replies with a FIN/ACK packet. Once this whole procedure is done, the connection is torn down properly.

As you will also later see, the TCP headers contain a checksum as well. The checksum consists of a simple hash of the packet. With this hash, we can with rather high accuracy see if a packet has been corrupted in any way during transit between the hosts.

The TCP headers must be able to perform all of the tasks above.

Let’s look at the TCP headers in detail. Each row is a 32-bit word.

TCP header:

Source port - bit 0 - 15. This is the source port of the packet. The source port was originally bound directly to a process on the sending system. Today, we use a hash between the IP addresses, and both the destination and source ports to achieve this uniqueness that we can bind to a single application or program.

Destination port - bit 16 - 31. This is the destination port of the TCP packet. Just as with the source port, this was originally bound directly to a process on the receiving system. Today, a hash is used instead, which allows us to have more open connections at the same time. When a packet is received, the destination and source ports are reversed in the reply back to the originally sending host, so that destination port is now source port, and source port is destination port.

Sequence Number - bit 32 - 63. The sequence number field is used to set a number on each TCP packet so that the TCP stream can be properly sequenced (e.g., the packets winds up in the correct order). The Sequence number is then returned in the ACK field to ackonowledge that the packet was properly received.

Acknowledgment Number - bit 64 - 95. This field is used when we acknowledge a specific packet a host has received. For example, we receive a packet with one Sequence number set, and if everything is okey with the packet, we reply with an ACK packet with the Acknowledgment number set to the same as the original Sequence number.

Data Offset - bit 96 - 99. This field indicates how long the TCP header is, and where the Data part of the packet actually starts. It is set with 4 bits, and measures the TCP header in 32 bit words. The header should always end at an even 32 bit boundary, even with different options set. This is possible thanks to the Padding field at the very end of the TCP header.

Reserved - bit 100 - 103. These bits are reserved for future usage. In RFC 793 this also included the CWR and ECE bits. According to RFC 793 bit 100-105 (i.e., this and the CWR and ECE fields) must be set to zero to be fully compliant. Later on, when we started introducing ECN, this caused a lot of troubles because a lot of Internet appliances such as firewalls and routers dropped packets with them set. This is still true as of writing this.

CWR - bit 104. This bit was added in RFC 3268 and is used by ECN. CWR stands for Congestion Window Reduced, and is used by the data sending part to inform the receiving part that the congestion window has been reduced. When the congestion window is reduced, we send less data per timeunit, to be able to cope with the total network load.

ECE - bit 105. This bit was also added with RFC 3268 and is used by ECN. ECE stands for ECN Echo. It is used by the TCP/IP stack on the receiver host to let the sending host know that it has received an CE packet. The same thing applies here, as for the CWR bit, it was originally a part of the reserved field and because of this, some networking appliances will simply drop the packet if these fields contain anything else than zeroes. This is actually still true for a lot of appliances unfortunately.

URG - bit 106. This field tells us if we should use the Urgent Pointer field or not. If set to 0, do not use Urgent Pointer, if set to 1, do use Urgent pointer.

ACK - bit 107. This bit is set to a packet to indicate that this is in reply to another packet that we received, and that contained data. An Acknowledgment packet is always sent to indicate that we have actually received a packet, and that it contained no errors. If this bit is set, the original data sender will check the Acknowledgment Number to see which packet is actually acknowledged, and then dump it from the buffers.

PSH - bit 108. The PUSH flag is used to tell the TCP protocol on any intermediate hosts to send the data on to the actual user, including the TCP implementation on the receiving host. This will push all data through, unregardless of where or how much of the TCP Window that has been pushed through yet.
RST - bit 109. The RESET flag is set to tell the other end to tear down the TCP connection. This is done in a couple of different scenarios, the main reasons being that the connection has crashed for some reason, if the connection does not exist, or if the packet is wrong in some way.

SYN - bit 110. The SYN (or Synchronize sequence numbers) is used during the initial establishment of a connection. It is set in two instances of the connection, the initial packet that opens the connection, and the reply SYN/ACK packet. It should never be used outside of those instances.

FIN - bit 111. The FIN bit indicates that the host that sent the FIN bit has no more data to send. When the other end sees the FIN bit, it will reply with a FIN/ACK. Once this is done, the host that originally sent the FIN bit can no longer send any data. However, the other end can continue to send data until it is finished, and will then send a FIN packet back, and wait for the final FIN/ACK, after which the connection is sent to a CLOSED state.

Window - bit 112 - 127. The Window field is used by the receiving host to tell the sender how much data the receiver permits at the moment. This is done by sending an ACK back, which contains the Sequence number that we want to acknowledge, and the Window field then contains the maximum accepted sequence numbers that the sending host can use before he receives the next ACK packet. The next ACK packet will update accepted Window which the sender may use.

Checksum - bit 128 - 143. This field contains the checksum of the whole TCP header. It is a one's complement of the one's complement sum of each 16 bit word in the header. If the header does not end on a 16 bit boundary, the additional bits are set to zero. While the checksum is calculated, the checksum field is set to zero. The checksum also covers a 96 bit pseudoheader containing the Destination-, Source-address, protocol, and TCP length. This is for extra security.

Urgent Pointer - bit 144 - 159. This is a pointer that points to the end of the data which is considered urgent. If the connection has important data that should be processed as soon as possible by the receiving end, the sender can set the URG flag and set the Urgent pointer to indicate where the urgent data ends.

Options - bit 160 - **. The Options field is a variable length field and contains optional headers that we may want to use. Basically, this field contains 3 subfields at all times. An initial field tells us the length of the Options field, a second field tells us which options are used, and then we have the actual options. A complete listing of all the TCP Options can be found in TCP options.
Padding - bit **. The padding field pads the TCP header until the whole header ends at a 32-bit boundary. This ensures that the data part of the packet begins on a 32-bit boundary, and no data is lost in the packet. The padding always consists of only zeros.

A sample of TCP communication between two hosts in "rpcinfo -p" captured by tcpdump (or snoop in Solaris) utility:

1 0.00000 ipc4.shanjing.com -> sun1.shanjing.com TCP D=111 S=750 Syn Seq=3368322776 Len=0 Win=5840 Options=
2 0.00031 sun1.shanjing.com -> ipc4.shanjing.com TCP D=750 S=111 Syn Ack=3368322777 Seq=1322806787 Len=0 Win=49232 Options=
3 0.00004 ipc4.shanjing.com -> sun1.shanjing.com TCP D=111 S=750 Ack=1322806788 Seq=3368322777 Len=0 Win=1460 Options=
4 0.00013 ipc4.shanjing.com -> sun1.shanjing.com PORTMAP C DUMP
5 0.00022 sun1.shanjing.com -> ipc4.shanjing.com TCP D=750 S=111 Ack=3368322821 Seq=1322806788 Len=0 Win=49188 Options=
6 0.00093 ipc4.shanjing.com -> sun1.shanjing.com TCP D=111 S=750 Ack=1322807580 Seq=3368322821 Len=0 Win=1856 Options=
7 0.00001 sun1.shanjing.com -> ipc4.shanjing.com PORTMAP R DUMP 38 map(s) found
8 0.01263 ipc4.shanjing.com -> sun1.shanjing.com TCP D=111 S=750 Fin Ack=1322807580 Seq=3368322821 Len=0 Win=1856 Options=
9 0.00013 sun1.shanjing.com -> ipc4.shanjing.com TCP D=750 S=111 Ack=3368322822 Seq=1322807580 Len=0 Win=49232 Options=
10 0.00032 sun1.shanjing.com -> ipc4.shanjing.com TCP D=750 S=111 Fin Ack=3368322822 Seq=1322807580 Len=0 Win=49232 Options=
11 0.00013 ipc4.shanjing.com -> sun1.shanjing.com TCP D=111 S=750 Ack=1322807581 Seq=3368322822 Len=0 Win=1856 Options=

Details:
ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 1 arrived at 22:24:53.67045
ETHER: Packet size = 74 bytes
ETHER: Destination = 0:c:29:2e:ed:c1,
ETHER: Source = 0:c:29:e5:d:fb,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 60 bytes
IP: Identification = 5703
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = a058
IP: Source address = 192.168.1.104, ipc4.shanjing.com
IP: Destination address = 192.168.1.100, sun1.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 750
TCP: Destination port = 111
TCP: Sequence number = 3368322776
TCP: Acknowledgement number = 0
TCP: Data offset = 40 bytes
TCP: Flags = 0x02
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...0 .... = No acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..1. = Syn
TCP: .... ...0 = No Fin
TCP: Window = 5840
TCP: Checksum = 0xc95d
TCP: Urgent pointer = 0
TCP: Options: (20 bytes)
TCP: - Maximum segment size = 1460 bytes
TCP: - SACK permitted option
TCP: - TS Val = 2134176, TS Echo = 0
TCP: - No operation
TCP: - Window scale = 2
TCP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 2 arrived at 22:24:53.67077
ETHER: Packet size = 78 bytes
ETHER: Destination = 0:c:29:e5:d:fb,
ETHER: Source = 0:c:29:2e:ed:c1,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 64 bytes
IP: Identification = 27277
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = 4c0e
IP: Source address = 192.168.1.100, sun1.shanjing.com
IP: Destination address = 192.168.1.104, ipc4.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 111
TCP: Destination port = 750
TCP: Sequence number = 1322806787
TCP: Acknowledgement number = 3368322777
TCP: Data offset = 44 bytes
TCP: Flags = 0x12
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..1. = Syn
TCP: .... ...0 = No Fin
TCP: Window = 49232
TCP: Checksum = 0xeedf
TCP: Urgent pointer = 0
TCP: Options: (24 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 1532405, TS Echo = 2134176
TCP: - Maximum segment size = 1460 bytes
TCP: - No operation
TCP: - Window scale = 0
TCP: - No operation
TCP: - No operation
TCP: - SACK permitted option
TCP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 3 arrived at 22:24:53.67082
ETHER: Packet size = 66 bytes
ETHER: Destination = 0:c:29:2e:ed:c1,
ETHER: Source = 0:c:29:e5:d:fb,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 52 bytes
IP: Identification = 5705
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = a05e
IP: Source address = 192.168.1.104, ipc4.shanjing.com
IP: Destination address = 192.168.1.100, sun1.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 750
TCP: Destination port = 111
TCP: Sequence number = 3368322777
TCP: Acknowledgement number = 1322806788
TCP: Data offset = 32 bytes
TCP: Flags = 0x10
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...0 = No Fin
TCP: Window = 1460
TCP: Checksum = 0xea46
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 2134177, TS Echo = 1532405
TCP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 4 arrived at 22:24:53.67095
ETHER: Packet size = 110 bytes
ETHER: Destination = 0:c:29:2e:ed:c1,
ETHER: Source = 0:c:29:e5:d:fb,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 96 bytes
IP: Identification = 5707
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = a030
IP: Source address = 192.168.1.104, ipc4.shanjing.com
IP: Destination address = 192.168.1.100, sun1.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 750
TCP: Destination port = 111 (Sun RPC)
TCP: Sequence number = 3368322777
TCP: Acknowledgement number = 1322806788
TCP: Data offset = 32 bytes
TCP: Flags = 0x18
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 1... = Push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...0 = No Fin
TCP: Window = 1460
TCP: Checksum = 0xe454
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 2134177, TS Echo = 1532405
TCP:
RPC: ----- SUN RPC Header -----
RPC:
RPC: Record Mark: last fragment, length = 40
RPC: Transaction id = 450618384
RPC: Type = 0 (Call)
RPC: RPC version = 2
RPC: Program = 100000 (PMAP), version = 2, procedure = 4
RPC: Credentials: Flavor = 0 (None), len = 0 bytes
RPC: Verifier : Flavor = 0 (None), len = 0 bytes
RPC:
PMAP: ----- Portmapper -----
PMAP:
PMAP: Proc = 4 (Dump the mappings)
PMAP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 5 arrived at 22:24:53.67117
ETHER: Packet size = 66 bytes
ETHER: Destination = 0:c:29:e5:d:fb,
ETHER: Source = 0:c:29:2e:ed:c1,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 52 bytes
IP: Identification = 27278
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = 4c19
IP: Source address = 192.168.1.100, sun1.shanjing.com
IP: Destination address = 192.168.1.104, ipc4.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 111
TCP: Destination port = 750
TCP: Sequence number = 1322806788
TCP: Acknowledgement number = 3368322821
TCP: Data offset = 32 bytes
TCP: Flags = 0x10
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...0 = No Fin
TCP: Window = 49188
TCP: Checksum = 0x2faa
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 1532405, TS Echo = 2134177
TCP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 6 arrived at 22:24:53.67211
ETHER: Packet size = 66 bytes
ETHER: Destination = 0:c:29:2e:ed:c1,
ETHER: Source = 0:c:29:e5:d:fb,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 52 bytes
IP: Identification = 5709
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = a05a
IP: Source address = 192.168.1.104, ipc4.shanjing.com
IP: Destination address = 192.168.1.100, sun1.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 750
TCP: Destination port = 111
TCP: Sequence number = 3368322821
TCP: Acknowledgement number = 1322807580
TCP: Data offset = 32 bytes
TCP: Flags = 0x10
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...0 = No Fin
TCP: Window = 1856
TCP: Checksum = 0xe574
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 2134179, TS Echo = 1532405
TCP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 7 arrived at 22:24:53.67212
ETHER: Packet size = 858 bytes
ETHER: Destination = 0:c:29:e5:d:fb,
ETHER: Source = 0:c:29:2e:ed:c1,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 844 bytes
IP: Identification = 27279
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = 4900
IP: Source address = 192.168.1.100, sun1.shanjing.com
IP: Destination address = 192.168.1.104, ipc4.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 111
TCP: Destination port = 750 (Sun RPC)
TCP: Sequence number = 1322806788
TCP: Acknowledgement number = 3368322821
TCP: Data offset = 32 bytes
TCP: Flags = 0x18
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 1... = Push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...0 = No Fin
TCP: Window = 49232
TCP: Checksum = 0xf9c4
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 1532405, TS Echo = 2134177
TCP:
RPC: ----- SUN RPC Header -----
RPC:
RPC: Record Mark: last fragment, length = 788
RPC: Transaction id = 450618384
RPC: Type = 1 (Reply)
RPC: This is a reply to frame 4
RPC: Status = 0 (Accepted)
RPC: Verifier : Flavor = 0 (None), len = 0 bytes
RPC: Accept status = 0 (Success)
RPC:
PMAP: ----- Portmapper -----
PMAP:
PMAP: Proc = 4 (Dump the mappings)
PMAP: Program Version Protocol Port
PMAP: 100000 4 6 111 PMAP
PMAP: 100000 3 6 111 PMAP
PMAP: 100000 2 6 111 PMAP
PMAP: 100000 4 17 111 PMAP
PMAP: 100000 3 17 111 PMAP
PMAP: 100000 2 17 111 PMAP
PMAP: 100024 1 17 32772 STATMON2
PMAP: 100024 1 6 32771 STATMON2
PMAP: 100133 1 17 32772 ?
PMAP: 100133 1 6 32771 ?
PMAP: 1073741824 1 6 32772 transient
PMAP: 100021 1 17 4045 NLM
PMAP: 100021 2 17 4045 NLM
PMAP: 100021 3 17 4045 NLM
PMAP: 100021 4 17 4045 NLM
PMAP: 100021 1 6 4045 NLM
PMAP: 100021 2 6 4045 NLM
PMAP: 100021 3 6 4045 NLM
PMAP: 100021 4 6 4045 NLM
PMAP: 100001 2 17 32773 RSTAT
PMAP: 100001 3 17 32773 RSTAT
PMAP: 100001 4 17 32773 RSTAT
PMAP: 100068 2 17 32774 CMSD
PMAP: 100068 3 17 32774 CMSD
PMAP: 100068 4 17 32774 CMSD
PMAP: 100068 5 17 32774 CMSD
PMAP: 100083 1 6 32775 ?
PMAP: 100002 2 6 32776 RUSERS
PMAP: 100002 3 6 32776 RUSERS
PMAP: 100002 2 17 32775 RUSERS
PMAP: 100002 3 17 32775 RUSERS
PMAP: 100011 1 17 32776 RQUOTA
PMAP: 300598 1 17 32779 ?
PMAP: 300598 1 6 32777 ?
PMAP: 805306368 1 17 32779 ?
PMAP: 805306368 1 6 32777 ?
PMAP: 100249 1 17 32780 ?
PMAP: 100249 1 6 32778 ?
PMAP: 38 maps
PMAP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 8 arrived at 22:24:53.68476
ETHER: Packet size = 66 bytes
ETHER: Destination = 0:c:29:2e:ed:c1,
ETHER: Source = 0:c:29:e5:d:fb,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 52 bytes
IP: Identification = 5711
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = a058
IP: Source address = 192.168.1.104, ipc4.shanjing.com
IP: Destination address = 192.168.1.100, sun1.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 750
TCP: Destination port = 111
TCP: Sequence number = 3368322821
TCP: Acknowledgement number = 1322807580
TCP: Data offset = 32 bytes
TCP: Flags = 0x11
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...1 = Fin
TCP: Window = 1856
TCP: Checksum = 0xe562
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 2134196, TS Echo = 1532405
TCP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 9 arrived at 22:24:53.68489
ETHER: Packet size = 66 bytes
ETHER: Destination = 0:c:29:e5:d:fb,
ETHER: Source = 0:c:29:2e:ed:c1,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 52 bytes
IP: Identification = 27280
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = 4c17
IP: Source address = 192.168.1.100, sun1.shanjing.com
IP: Destination address = 192.168.1.104, ipc4.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 111
TCP: Destination port = 750
TCP: Sequence number = 1322807580
TCP: Acknowledgement number = 3368322822
TCP: Data offset = 32 bytes
TCP: Flags = 0x10
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...0 = No Fin
TCP: Window = 49232
TCP: Checksum = 0x2c51
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 1532406, TS Echo = 2134196
TCP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 10 arrived at 22:24:53.68522
ETHER: Packet size = 66 bytes
ETHER: Destination = 0:c:29:e5:d:fb,
ETHER: Source = 0:c:29:2e:ed:c1,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 52 bytes
IP: Identification = 27281
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = 4c16
IP: Source address = 192.168.1.100, sun1.shanjing.com
IP: Destination address = 192.168.1.104, ipc4.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 111
TCP: Destination port = 750
TCP: Sequence number = 1322807580
TCP: Acknowledgement number = 3368322822
TCP: Data offset = 32 bytes
TCP: Flags = 0x11
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...1 = Fin
TCP: Window = 49232
TCP: Checksum = 0x2c50
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 1532406, TS Echo = 2134196
TCP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 11 arrived at 22:24:53.68535
ETHER: Packet size = 66 bytes
ETHER: Destination = 0:c:29:2e:ed:c1,
ETHER: Source = 0:c:29:e5:d:fb,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 52 bytes
IP: Identification = 2
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = b6a5
IP: Source address = 192.168.1.104, ipc4.shanjing.com
IP: Destination address = 192.168.1.100, sun1.shanjing.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 750
TCP: Destination port = 111
TCP: Sequence number = 3368322822
TCP: Acknowledgement number = 1322807581
TCP: Data offset = 32 bytes
TCP: Flags = 0x10
TCP: 0... .... = No ECN congestion window reduced
TCP: .0.. .... = No ECN echo
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..0. = No Syn
TCP: .... ...0 = No Fin
TCP: Window = 1856
TCP: Checksum = 0xe55e
TCP: Urgent pointer = 0
TCP: Options: (12 bytes)
TCP: - No operation
TCP: - No operation
TCP: - TS Val = 2134198, TS Echo = 1532406
TCP:

Understanding DNS Security in 1 Minute!

DNS Data Flow Diagram

Number	Area	Threat
(1)	Zone Files	File Corruption (malicious or accidental). Local threat.
(2)	Dynamic Updates	Unauthorized Updates, IP address spoofing (impersonating update source). Server to Server (TSIG Transaction) threat.
(3)	Zone Transfers	IP address spoofing (impersonating update source). Server to Server (TSIG Transaction) threat.
(4)	Remote Queries	Cache Poisoning by IP spoofing, data interception, or a subverted Master or Slave. Server to Client (DNSSEC) threat.
(5)	Resolver Queries	Data interception, Poisoned Cache, subverted Master or Slave, local IP spoofing. Remote Client-client (DNSSEC) threat.

We classify each threat type below. This classification simply allows us select appropriate remedies and strategies for avoiding or securing our system. The numbering used below relates to the diagram.

(1) The primary source of Zone data is normally the Zone Files (and don't forget the named.conf file which contains lots of interesting data as well). This data should be secure and securely backed up. This threat is classified as Local and is typically handled by good system administration.

(2) The BIND default is to deny Dynamic Zone Updates. If you have enabled this service or require to it poses a serious threat to the integrity of your Zone files and should be protected. This is classified as a Server-Server (Transaction) threat.

(3) If you run slave servers you will do zone transfers. Note: You do NOT have to run with slave servers, you can run with multiple masters and eliminate the transfer threat entirely. This is classified as a Server-Server (Transaction) threat.

(4) The possibility of Remote Cache Poisoning due to IP spoofing, data interception and other hacks is a judgement call if you are running a simple web site. If the site is high profile, open to competitive threat or is a high revenue earner you have probably implemented solutions already. This is classified as a Server-Client threat.

(5) The current DNSSEC standards define a security aware resolver and this concept is under active development by an number of groups round the world. This is classified as a Server-Client threat.

Local Security

Normal system administration practices such as ensuring that files (configuration and zone files) are securely backed-up, proper read and write permissions applied and sensible physical access control to servers may be sufficient.

Implementing a Stealth (or Split) DNS server provides a more serious solution depending on available resources.

Finally you can run BIND (named) in a chroot jail.

Server-Server Security (TSIG Transactions)

Zone transfers. If you have slave servers you will do zone transfers. BIND provides Access Control Lists (ACLs) which allow simple IP address protection. While IP based ACLs are relatively easy to subvert using IP addreess spoofing they are a lot better than nothing and require very little work. You can run with multiple masters (no slaves) and eliminate the threat entirely. You will have to manually synchronise zone file updates but this may be a simpler solution if changes are not frequent.

Dynamic Updates. If you must run with this service it should be secured. BIND provides Access Control Lists (ACLs) which allow simple IP address protection but this is probably not adequate unless you can secure the IP addresses, that is, all systems are behind a firewall/DMZ/NAT or the updating hosts are using private IP addresses.

TSIG/TKEY If all other solutions fail DNS specifications (RFC 2845 - TSIG and RFC 2930 - TKEY) provide authentication protocol enhancements to secure these Server-Server transactions.

TSIG and TKEY implementations are messy but not too complicated simply because of the scope of the problem. With Server-Server transactions there is a finite and normally small number of hosts involved. The protocols depend on a shared secret between the master and the slave(s) or updater(s). It is further assumed that you can get the shared secret securely to the peer server by some means not covered in the protocol itself. This process, known as key exchange, may not be trivial (typically long random strings of base64 characters are involved) but you can use the telephone(!), mail, fax or PGP email among other methods.

The shared-secret is open to brute-force attacks so frequent (monthly or more) changing of shared secrets will become a fact of life. TKEY allows automation of key-exchange using a Diffie-Hellman algorithm but starts with a shared secret! TKEY appears to have very limited, if any, usage.

Server-Client Security (DNSSEC)

The classic Remote Poisoned cache problem is not trivial to solve simply because there may be an infinitely large number of Remote Caches involved. It is not reasonable to assume that you can use a shared secret.

Instead DNSSEC relies on public/private key authentication. The DNSSEC specifications (RFC 4033, RFC 4034 and RFC 4035 augmented with others) attempt to answer three questions:

Authentication - the DNS responding really is the DNS that the request was sent to.
Integrity - the response is complete and nothing is missing or changed.
Proof of non-existance - if the DNS returns a status that the name does not exist (NXDOMAIN) this response can be proven to have come from the authoritative server.

Data Encapsulation

OSI Network Services Layers

Data Encapsulation

Encapsulate IP Datagrams Inside Ethernet Frames

Two major methods are available to encapsulate IP for Ethernet networks:
1. RFC 894 - is more efficient Ethernet II encapsulation and is most commonly used.

2. IEEE 802.3/802.2 IP Encapsulation.

Analyzing ARP Weakness in 1 Minute

Many network attacks require the the attacker can intercept the network traffic going to and from the victim (Man-in-the-middle attacks). In environments using Ethernet switches (e.g. today's wireless WiFi which uses IEEE 802.11 wireless network standard) every host/computer connected to the switch operates within its own collision domain (port). To intercept traffic, circumvention of the switch collision domain is necessary. This is usually done by employing ARP-based attacks against the switch, Poison ARP Caches.

Switches have a finite table in which they store mappings of MAC addresses with ports. When this table overflows, the switch usually does one of the two things:
1. Operates as a hub, repeating all incoming frames to all other ports, this effectively combining all ports on the switch into one collision domain.
2. Locks up entirely, discarding all incoming frames.

On a network with a switch which fails operating effectively as a hub when the MAC address table is filled, an attacker can flood the switch with frames containing bogus MAC addresses. This overflows its state table and forces it to operate as a hub.

However, there are limitations to this approach. Many switches do not fail as hubs when their table fills. Because of these limitations, other attack methods are used instead, such as ARP cache poisoning.

ARP Cache Poisoning

1. Attacking host Eve sends spoofed ARP packets to the victim host Alice. This poisons the ARP table on host Alice so that it associates the Eve's MAC address (ee:ee:ee:ee:ee:ee) with the IP address of Router 10.0.0.1.

2. Attacking host Eve send spoofed ARP packets to the router. This poisons the ARP table on the router R so that it associated the MAC address of the attacking host Eve with the IP address of the victim Alice 10.0.0.10.

3. Attacking host Eve routes all traffic between Alice and the router which sniffing the traffic flowing through Eve.

Perform ARP Cache Poisoning with ARP Replies

Using arp command to manually poison ARP table

One of the methods of poisoning ARP tables uses ARP responses to exploit a vulnerability in most ARP cache, that system will accept any ARP response updating that entry, even if that system never sent out an ARP request.

This ARP reply cache poisoning method can be performed manually using the arp command.

#arp -s other-host other-MAC-address pub

The -s option is legitimately useful for implementing ARP proxies, but can also be used by attackers to carry out cache poisoning.

In addition to manually poison ARP tables, automated tools are also available with streamline ARP cache poisoning. The dsniff suite of software includes the arpspoof utility which cleanly poisons ARP caches on the victim, then cleans up the victim's ARP cache upon exit. It also can be used to attack all the hosts in the broadcast domain.

Information about arpspoof and dsniff can be found at http://www.monkey.org/~dugsong/dsniff/

A good example of executing arpspoof can be found at http://www.irongeek.com/i.php?page=security/arpspoof&mode=print

Poisoning ARP table is the first step to compromise the target host. Once attackers successfully poison the ARP tables, they can start the real attacks against your host like poisoning DNS caches and redirecting target host's browser to forged web pages.

Understanding Ethernet Operation and ARP Security in 1 Minute

Ethernet Operation
Access to the shared communications medium is determined by the MAC mechanism embedded in each network card. The MAC mechanism functions somewhat like multi-participant conference call. Everyone on the call must listen for a period of quiet before speaking (Carrier Sense). Once a pause occurs in communication, everyone has an equal chance to say something (Multiple Access). If two people starting talking at the same instant, they detect that fact and quit speaking (Collision Detection.) Bothe people will wait a random amount of time and try again. This CSMA/CD mechanism is invoked for every transmission on the network.

With Ethernet, after 16 consecutive collisions, the frame is aborted.

A collision domain is the set of devices which will see a frame transmitted by a given host.
A broadcast domain is the set of devices which will see a layer 2 broadcast frame (a frame with a destination MAC address of FF:FF:FF:FF:FF:FF, the Ethernet broadcast address) transmitted by a host.

Several devices are used when networking multiple Ethernet devices together, including: Hubs, Switches, Bridges.

A Hub operates at the OSI model's physical layer. It acts as a repeater. Hubs have one broadcast domain, and one collision domain.

A switch operates at the OSI model's data link layer. All switches examine incoming frames to dtermine the MAC address of the sender's interface. They use this information to build a MAC address table which has "MAC address:swithc port" pair. Using this table, the switch then sends received frames only out the port associated with that frame's destination MAC address. Switches have one broadcast domain and many collision domains. Every single port on the switch constitutes a separate collision domain.

Bridges is functionally and operationally equivalent to a switch. However, bridges have software-based frame-forwarding engines wile switch contain a hardware-based frame-forwarding engine.

Ethernet Security Concern - Attacking switch's MAC address table

Within a collision domain, any node sees all network traffic to or from every other node within that same collision domain. Usually, nodes ignore all received frames which are not addressed to either the node's MAC address or to the broadcast MAC address. However, most network interfaces can override this behavior by operating in promiscuous mode. In promiscuous mode, a network interface processes all received frames.

Switches, however, provide a barrier to protect hosts with promiscuous mode interface. On a switch, every port is a separate collision domain. As result, with switch, attached hosts operating in promiscuous mode only see broadcast frames and frames directly addressed to the host.

To sniff network traffic, a network attacker must overcome the obstacle switches provide and have a network interface operating in promiscuous mode. Often, this is done by flooding the switch with spoofed Ethernet frames for which the source MAC address is randomly generated. The switch must store the source address of these frames. By generating hundreds of bogus source MAC addresses, the attacker can fill the switch's MAC address table. Most switches revert to operation in hub mode when their MAC address table is full. There are tools like macoff can be used to source MAC address flooding. Switches provide MAC address lockout mechanism can also protect MAC address flooding.

Counteract : Detect Promiscuous Network Interfaces

As an administrator, you should monitor your network regularly to detect promiscuous mode interfaces. You can use the following approaches:
1. Send an ICMP echo request or ARP request to the suspected host with incorrect destination MAC address. If the remote interface is in promiscuous mode, it will respond to the echo/ARP request.
2. Send IP traffic with incorrect destination MAC address and spoofed source IP addresses to the remote host, then monitor the remote host's outbound traffic for reverse DNS lookup requests fro those spoofed source IP addresses.
3. Tools like sentinel available at http://packetstormsecurity.nl/UNIX/IDS/sentinel/ can test if remote host has promiscuous interface.

Additional related tools : snoop, libpcap library, tcpdump, Ethereal.

Review ARP Operation

Before an IP packet can be transmitted to another host, it must be encapsulated inside a layer 2 frame. When using Ethernet for layer 2, the frame must have a destination MAC address specifying the location of the recipient host. For this process to work, a mapping protocol which can determine the recipient's MAC address from the recipient's IP address is required. This mapping protocol is Address Resolution Protocol (ARP).

In typical ARP operation, host A seeking to contact an IP address of host B on the same subnet will issue a layer 2 broadcast ARP request. This request will broadcast the IP adddress of host B, asking host B's MAC address. Host B receiving the broadcast will respond to this request with a unicats ARP replay to host A. Host A then cache that information in its ARP table.

tcpdump capture of ARP operation,

Host A -> ff:ff:ff:ff:ff:ff ARP who has 10.153.11.12? Tell 10.153.11.5
Host B -> Host A ARP 10.153.11.12 is at 00:3c:ba:05:a8:d2

Examining the ARP cache,
/usr/sbin/arp -a
Device IP Address Mask Flags Phys Addr
------ ------------------- ---------- ------ --------------------
hme0 10.100.9.6 255.255.255.255 00:05:75:7a:81:1b

/usr/sbin/arp -d 10.100.9.6
/usr/sbin/arp -s 10.100.9.12 00:01:03:DE:A1:57

Additional Ethernet/IP security related information can be found in my blog "Analyzing IP and ARP Weaknesses in 1 Minute".

Shan's "Fix IT in 1 Minute!" UNIX Admin Blog

TCP connection states vs netstat output

TCP Connection States

Netstat Output

Understanding TCP Headers in 1 Minute!

Understanding DNS Security in 1 Minute!

Local Security

Server-Server Security (TSIG Transactions)

Server-Client Security (DNSSEC)

Data Encapsulation

Analyzing ARP Weakness in 1 Minute

Understanding Ethernet Operation and ARP Security in 1 Minute

About Me

Table of Contents

Search This Blog

Geek music to get wired in

Visitor Tracking by Country

My Favorite Links

sitemeter